CVE-2023-28814

Critical

Published: 17 October 2025

Published

17 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0014 33.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-28814 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2023-28814 is an improper file upload control vulnerability (CWE-434) present in some versions of Hikvision's iSecure Center product. This software is released exclusively for China's domestic market, with no overseas release. The issue stems from inadequate verification of uploaded files, enabling attackers to upload malicious files to the server. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.

Unauthenticated attackers with network access can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows uploading malicious files to the server, potentially resulting in high impacts to confidentiality, integrity, and availability.

Hikvision has issued a security notice on this vulnerability at https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/2023-03/. Security practitioners should consult this advisory for information on affected versions and mitigation steps, such as applying patches if available.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-32449

Vulnerability details

Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded, attackers may upload malicious files to the server. iSecure Center is software released for China's domestic…

market only, with no overseas release.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability allows unauthenticated remote attackers to exploit a public-facing application via improper file upload control, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0